NAT Firewall Rules

Access control rules support domain name filtering and traffic filtering based on geographic location requirements. NAT firewall rules provide two access control rule lists: Inbound Rules and Outbound Rules. Inbound Rules: control north-south traffic from outside to inside within the Internet boundary. Outbound Rules: control north-south traffic from inside to outside within the Internet boundary. This section uses Inbound Rules as an example to provide relevant operational instructions. The operations for Outbound Rules are similar.

Operation Guide

1. Log in to the CFW console. In the left sidebar, choose Access Control > NAT Boundary Rule.
2. On the NAT Firewall Rule page, click Inbound Rules to go to the Inbound Rules page.
3. On the Inbound Rules page, you can create access control rules, and view the rule list (including the used quota for inbound and outbound rules and the total quota for the rule list), recent operation records, and access control rule details. The recent operation records display the latest operations performed by users on the rule list.
   • Click Details to view the details of the operation record.
   • Click View Operation Logs to view detailed operation records.
4. Add a rule. On the Inbound Rules page, you can configure rules. The following operations describe how to add an inbound rule.
   1. On the Inbound Rules page, click Add Rule. The Add Inbound Rule pop-up window is displayed.
   2. In the Add Inbound Rule pop-up window, configure the rule. For Source Type, select IP address, geographic location, cloud vendor, or address template. For Destination Type, select IP address, resource tag, or address template. Check either Execute First or Execute Last based on the rule priority. After you configure Access Source and Access Destination, specify the destination port, set information such as the required protocol and policy, add remarks in the description field, and then click OK to complete the rule configuration.
      Field description:

• Source Type:
  • IP address: any IP address or CIDR block address, such as 10.10.10.10 or 10.10.10.10/24. Multiple entries are allowed and need to be separated by commas.
  • Geographic location: the actual geographic location corresponding to the IP address.
  • Cloud vendor: the service IP address corresponding to each cloud service provider.
  • Address template: a user-defined IP address template.
• Destination Type:
  • IP Address: The access destination of inbound rules applies only to your public IP addresses. If you enter a CIDR block address, the backend will automatically associate all your public IP addresses within the IP address range. Multiple entries are allowed and need to be separated by commas.
  • Resource Tag: the tag of the resource based on which the access destination is selected. The public IP addresses of instances within the tag will match Internet boundary rules.
  • Address Template: Select a user-defined IP address template as the access destination.
• Port Protocol Type: the input mode of the destination port. Bypass firewalls support only manual input of port numbers.
• Rule Priority: the execution priority of a rule. It can be set to Execute First or Execute Last.
• Priority: the priority of access control rules. The execution order of outbound rules and that of inbound rules are independent of each other. The rule with a higher priority is matched first. If a rule is hit, subsequent rules will not be matched. When you modify the priority of a rule, the priorities of all subsequent rules will increase by 1. When you delete a rule, the priorities of all subsequent rules will decrease by 1.
• Access Source: The access source of an inbound rule applies to all public IP addresses. The access source type can be an IP address, geographic location, cloud vendor, or address template.
• Access Destination: The access destination of an inbound rule applies only to all private network assets within the effective scope. It can be an IP address, asset instance, resource tag, address template, or asset group. The access source types and access destination types supported by outbound rules are the exact opposite of those supported by inbound rules.
• Domain Name Rule (Supported for outbound rules): determines whether to allow traffic based on the domain name in the access request. The IP address resolved from the domain name is not verified.
• Domain Name Resolution Rule (Supported for outbound rules): allows the actual IP address requested by the domain name based on the protocol and the region in which the instance resides.
• Destination Port: TCP or UDP rules support a single port number (such as 80), port range with "/" (such as 80/80, -1/-1, and 1/65535), and discrete port values separated with commas (such as 80,443,3380/3389). For ICMP rules, port configuration is not required.
• Protocol: In the current version, the inbound rules support TCP and UDP, and the outbound rules support protocols such as TCP, UDP, ICMP, HTTP, HTTPS, SMTP, SMTPS, DNS, and FTP.
• Policy:
  • Allow: Allow the traffic that hits rules and record the hit count and traffic logs, but not record access control logs.
  • Observe: Allow traffic that hits rules and record the hit count, access control logs, and traffic logs.
  • Block: blocks the traffic that hits rules. The number of hits and access control logs are recorded. Traffic logs record the data packet information of a request in the traffic.
• Effective Scope: the firewall scope to which the current rule applies. It can be set to Global Rules, specific regional instances, or specific firewall instances.
• Description: the rule description. It can contain a maximum of 50 characters. You can insert special rule settings by using ##. The current version supports #long connection#, which is suitable for the long connection business scenario.
• NAT Firewall Wildcard Rule:
• Firewalls provide different rules for wildcard IP addresses, wildcard ports, and wildcard domain names.

  Input Field	Input Example	Description
  Access source/access destination	0.0.0.0/0	Indicates all IP addresses.
  Domain name	*	Indicates all domain names.
  Domain name	*.aa.com	Indicates a second-level domain name aa.com starting with *.
  Target port	-1/-1	Indicates all ports.
  Destination port	1/65535	Indicates all ports.
  Target port	80,443,3389	Indicates that it is effective for ports 80, 443, and 3389.
  Target port	80/443	Indicates that it is effective for all ports between 80 and 443.
  Target port	80/443,3389	Indicates that it is effective for all ports between 80 and 443 as well as port 3389.

5. Click Copy in the operation column on the right side to add multiple rules.

   Note:

   In the Add Inbound Rule pop-up window, each row represents a rule. When a rule is added, it is inserted to the end of the list by default. That is, the last rule with the largest priority value is assigned the lowest priority.

• Scenario 1: The rule list has been edited locally. Multiple rules need to be added in batches to improve efficiency.
  1. Click Copy in the operation column on the right side to add a line of rule below the current position. A maximum of 10 rules can be added at a time.
  2. Complete all fields in the form.
  3. Before you commit the rules, check whether their execution order meets expectations.
  4. Click OK to commit the configured rules.
• Scenario 2: You need to configure multiple rules for an IP address.
  1. Edit a line of rule. Edit only the fields that need to be filled in repeatedly.
  2. Click Copy in the operation column on the right side to add a line of rule below the current position and automatically copy the content that has been filled in from the previous line. A maximum of 10 rules can be added at a time.
  3. Complete other fields in the form and fill in the fields that do not need to be filled in repeatedly.
  4. Before you commit the rules, check whether their execution order meets expectations.
  5. Click OK to commit the configured rules.

6. Import rules: Click Import Rules to import rules from a local file. You can specify the import location and download the import template.